Where does one get the dataset of email id's of Adobe users ?
Disqus cracked – Security flaw reveals users’ e-mail addresses
51–60 of 92 posts
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#52I don't get it, if your email address is so private then why you share it with 3rd parties? Also, why would your email address be so private if the spam filters are so efficient nowadays, what's the harm in having a public email address? Please enlighten me.
> I don't get it, if your email address is so private then why you share it with 3rd parties? How would you use it otherwise? My backyard is private, but I share it with a few 3rd parties. That doesn't mean i intent to share my backyard with the entire world. There is an element of trust with particular 3rd parties that is being violated. Why is that so hard to understand?
The address of your backyard is not private.
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#53If a political organisation was revealing the identities behind anonymous speech on a jewish forum, the world would be up in arms. If the identities on a gay board was published, Obama himself would be apologising. Now the identities of thousands of people commenting on politics in Sweden was revealed, and it's OK because "they" are the bad guys, says the extreme left organisation Researchgruppen. The slippery slope…
Well yes, because of hate speech and potential violence...
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#54If a political organisation was revealing the identities behind anonymous speech on a jewish forum, the world would be up in arms. If the identities on a gay board was published, Obama himself would be apologising. Now the identities of thousands of people commenting on politics in Sweden was revealed, and it's OK because "they" are the bad guys, says the extreme left organisation Researchgruppen. The slippery slope…
Press freedom generally trumps privacy, as it should.
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#55Earlier quoted context omitted.
If I go to comment at a wordpress site it says this: "Email (required) (Address never made public)" MD5 leaks of my email address into web pages is in fact making my address public. Hey lmm, duh, when you make a comment under a different name but with the same email address that you think is anonymous at your local hiv testing site, you may not expect that your insurance company can track that down because wordpress…
No it doesn't. You need to know the email address up front in order to generate the hash.
But the point is that you can easily brute force that, especially if you have a list of people that you suspect may be making such comments and their email addresses.
Saying that your email is kept private by taking its MD5 sum is like expecting than an unsalted MD5 sum for a password hash in a publicly accessible password database will be secure for people with weak, brute-forcible passwords like "1234". You are providing a little bit of obfuscation, but no real security.
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#56Earlier quoted context omitted.
But if they haven't changed their password after the Adobe hack then they're already boned, aren't they? How doe the Disqus vuln add to that?
You don't want to try 150 million Adobe logins on Disqus. You want to identify which ones to test first.
Maybe I'm being dense this morning... if I were in the Adobe 150M, some criminals would already have my email address, right? How does getting Disqus's hash of it help them out?
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#57Earlier quoted context omitted.
If I go to comment at a wordpress site it says this: "Email (required) (Address never made public)" MD5 leaks of my email address into web pages is in fact making my address public. Hey lmm, duh, when you make a comment under a different name but with the same email address that you think is anonymous at your local hiv testing site, you may not expect that your insurance company can track that down because wordpress…
No it doesn't. You need to know the email address up front in order to generate the hash.
[deleted]
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#58Earlier quoted context omitted.
But if they haven't changed their password after the Adobe hack then they're already boned, aren't they? How doe the Disqus vuln add to that?
You don't want to try 150 million Adobe logins on Disqus. You want to identify which ones to test first.
By linking your Disqus comments to your e-mail. For example your comments on sexual preference blogs, political blogs etc. Mapping your life, possibly opening up for blackmail.
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#59Earlier quoted context omitted.
In general, what you're asking about is called a "salted hash". I don't understand enough about Disqus's system to say it would definitely have prevented this vulnerability.
A salted hash only slows down brute-force attacks and dictionary attacks. The salt is still stored with the hash, so you could still eventually match the email address with the hash. Instead of hashing each email address once and comparing it with all of your collected hashes, you'd have to hash each email address using every salt until you found a match.
Sure since they're using MD5 then a salt wouldn't solve their problem, especially if the salt were also part of the url. And let's not pretend that the url itself is somehow secret: there are many ways to collect those, particularly if specific users are targeted. Usually when people are this boneheaded about hashes they're trying to save storage space, but I can't imagine that storing a separate random identifier would add significantly to Disqus's storage.
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#60Nice. Glad I decided against using Disqus for my site.